{"id":"pst_01M39QMEHCF3EW5MTX7DD4M5EE","url":"https://openvibe.blog/@openvibe/patch-notes-the-network-changelog-and-its-patch-notes","blog":{"id":"blg_01M362MF0EDJ7QHQTRD8A3Q981","handle":"openvibe","title":"The OpenVibe blog","url":"https://openvibe.blog/"},"title":"Patch notes: The network changelog and its patch notes","summary":"What shipped on OpenVibe on 2026-09-24: 79 changes to OpenVibe.Network, OpenVibe.Blog, OpenVibe.Host, OpenVibe.Live, OpenVibe.Games, OpenVibe.Tips and 9 more.","body_markdown":"What shipped on OpenVibe on 2026-09-24: 79 changes to OpenVibe.Network, OpenVibe.Blog, OpenVibe.Host, OpenVibe.Live, OpenVibe.Games, OpenVibe.Tips and 9 more. Every line below is a commit message from the OpenVibers repositories, linked to the change itself.\n\n## Highlights\n\n- **OpenVibe.Blog:** The network changelog and its patch notes: every OpenVibe site's shipped commits in one feed, published on the blog in batches. The worker reads each service's repository and current release from OpenVibe.Network's registry, takes the… ([`32cb1aa`](https://github.com/OpenVibers/OpenVibe.Blog/commit/32cb1aa0eb6f9fef7a4728829d7b466c64e5aa34))\n\n## OpenVibe.Network\n\n[openvibe.network](https://openvibe.network) · [repository](https://github.com/OpenVibers/OpenVibe.Network)\n\n- Unknown paths answer 404 (roadmap §2.5, D44): the apex sent the account hub (my.html) with 200 for any path, so openvibe.network/ looked like a page. Every real page keeps its own route; the account hub answers only at its own… ([`f87b514`](https://github.com/OpenVibers/OpenVibe.Network/commit/f87b5149274d5147df201c6e233508f7e8e83275))\n- OpenID Connect discovery at the issuer (roadmap §4.1, §15.4): https://openvibe.network/.well-known/openid-configuration answered with the account page; discovery lived only at /oauth/.well-known/openid-configuration. The document is now… ([`abee5dc`](https://github.com/OpenVibers/OpenVibe.Network/commit/abee5dc11cdd8df57ca488820540bea6b78d614b))\n- Refresh tokens (roadmap §18.2(2)): oauth_tokens held each refresh token in clear, and presenting a rotated token again only failed. Now only its SHA-256 is stored; every token belongs to the family of the sign-in that issued it (family_id)… ([`1cf0191`](https://github.com/OpenVibers/OpenVibe.Network/commit/1cf0191c805e118d6addaf64968e853bf260c174))\n- Provider secrets from the environment first (roadmap §18.2(12)): the Resend API key and webhook secret, the Discord bot token and OAuth client secret, and the VAPID private key were read only from site_settings in plaintext. Each now has a… ([`70050bc`](https://github.com/OpenVibers/OpenVibe.Network/commit/70050bca657252f135af45ba1891d8c87abd3ddd))\n- secrets-out-of-db.js --copy-to-env [--apply]: moves each provider secret the database holds and the env file does not set (an empty VAR= counts as unset) into /etc/openvibe/network.env as VAR=value, after keeping the previous file as… ([`11e716d`](https://github.com/OpenVibers/OpenVibe.Network/commit/11e716d04e4ecc67d5356a17a6dfc79c67655cf2))\n- Internal-key retirement (register C-50/C-52): GET /internal/url-registry/resolved, GET /internal/coins/stats, POST /internal/resolve-anon, POST /internal/identity/legacy-map and POST /internal/link-account (the routes principal_usage still… ([`829dafa`](https://github.com/OpenVibers/OpenVibe.Network/commit/829dafa5ccdce5dee1161717d4ab26ea762a03cd))\n- Principals: openre, media and community hold live.lineage.resolve for audience openvibe.live (roadmap §10.5/§15.10, D20-R1), so OpenRe, Media and Community's Pulse can ask Live's canonical channel/owner resolver (GET|POST… ([`80a841c`](https://github.com/OpenVibers/OpenVibe.Network/commit/80a841cd81c17342c4e86d45de57cfab2fb20965))\n- openvibe-contracts v0.33.1: tools.tool.read is active (Tools serves GET /api/v1/tools on the gateway and every satellite), so the registry and /status show it as such; tools.tool@1 1.1.0 adds optional keywords and examples. Additive; pins… ([`9a59212`](https://github.com/OpenVibers/OpenVibe.Network/commit/9a59212aaf5b363927a03f8fd907975ba4ce6712))\n- Registry (roadmap W2 D4, §5.1, §5.3): /api/v1/registry/categories and /featured answered 404. categories[/:id] groups every service by what it is, each with its rule, from Network's exposure overlay and site list: site, platform, library… ([`9e64f60`](https://github.com/OpenVibers/OpenVibe.Network/commit/9e64f600ec65dc161c3910291508c5032958d6dd))\n- Admin settings: the 'prefer the environment variable' hint shows only for provider secrets, not for the VAPID public key (read environment-first too, but not a secret); the settings row says secret: true|false ([`d063df1`](https://github.com/OpenVibers/OpenVibe.Network/commit/d063df17990051db91e6e102c41e27f881cb82a7))\n- Follow notification links to the follower's channel (openvibe.live/@); it linked to openvibe.network/user/, a page Network never had (a 404 since unknown paths stopped answering the account page) ([`43dd0c5`](https://github.com/OpenVibers/OpenVibe.Network/commit/43dd0c539db41162d45096b22f83b33f8018111c))\n- openvibe-contracts v0.34.1 (Tools platform S7): sandbox apps hold tools.tool.read and tools.tool.run by default (the run API is live); the self-service catalog lists public capabilities only (partner ones like tools.net.probe are… ([`1664d04`](https://github.com/OpenVibers/OpenVibe.Network/commit/1664d0427a24fee459f9e4416c38842a9ddcad84))\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`26c0395`](https://github.com/OpenVibers/OpenVibe.Network/commit/26c0395dbd9b654cd53c9ba33d38255a5fc32d27))\n- Roadmap baseline regenerated from origin/main (2026-09-24): D20 remaining is the consumers' switch and OpenRe session lineage (Media owner_subject done, grants issued); new Live tables (channel_points_log, opencoin_admin_grants… ([`89f0e44`](https://github.com/OpenVibers/OpenVibe.Network/commit/89f0e44dd91e620c3628308296cfd73a3c7aa5e0))\n- Community may publish its events (events.event.publish on openvibe.events); openvibe-contracts v0.35.0 (community.* payload contracts) ([`1837cb8`](https://github.com/OpenVibers/OpenVibe.Network/commit/1837cb890280e2c8f589d9338b9a27471d6121d7))\n- Tools grants: live, chat and community hold tools.tool.run and tools.job.read on openvibe.tools, so their Tools run API calls (kiosk page titles, audio conversion, save-as-paste) run on the service tier, never network probes ([`cbe77e1`](https://github.com/OpenVibers/OpenVibe.Network/commit/cbe77e15409cbfd387419c48b4b14c2a089f9a33))\n- Your recent tools on my.openvibe.network (the tools.usage module OpenVibe.Tools keeps, named from the public Tools registry, built with DOM nodes); Tools may index its tools in Search (search.document.write on openvibe.search) ([`1de2e22`](https://github.com/OpenVibers/OpenVibe.Network/commit/1de2e22920dce40ce92b4f9d1117f45bee989a3f))\n- Network issues staff capabilities in user tokens (D05, ADR-022): staff members' access tokens (login and OAuth) carry staff_caps from the contracts staff map, and the owner carries is_owner; people who are not staff carry neither, so their… ([`dde3374`](https://github.com/OpenVibers/OpenVibe.Network/commit/dde337433d9ff6f4ed3670e6ce678c0c9a3bc018))\n- AI may publish its ai.run.* events (events.event.publish on openvibe.events) ([`cbca807`](https://github.com/OpenVibers/OpenVibe.Network/commit/cbca807127dcb9b7ed667b13f5a0807bbb5cb1fe))\n- Blog may run its AI workflows (ai.run.create and ai.run.read in the blog namespace on openvibe.ai) for Draft with AI ([`fba96a0`](https://github.com/OpenVibers/OpenVibe.Network/commit/fba96a039b5a7b8e612d66c089b965cafa2d9950))\n- Recently shipped across OpenVibe on the home page: openvibe-shared v1.8.0 (served as /shared/shipped.js for every site) renders the network changelog from openvibe.blog, each change linked to its commit and the latest Patch notes post… ([`6e794b9`](https://github.com/OpenVibers/OpenVibe.Network/commit/6e794b93154b42cd1d1a40c56e37bd912bd68535))\n- CORS: every first-party domain the service manifests declare is an allowed origin (exact https origins, never a wildcard). openvibe.blog, openvibe.wiki and openvibe.codes were missing from the hard-coded list, so the shared navbar's… ([`90cd58e`](https://github.com/OpenVibers/OpenVibe.Network/commit/90cd58e731308ece95c31ace3381df83f7a874d4))\n- What shipped, network-wide: /api/v1/changelog proxies OpenVibe.Blog's changelog (60 s cache, stale on failure, public CORS) so every site's shared widget reads it from openvibe.network; /updates renders the whole network's log (server-side… ([`0b3b2e3`](https://github.com/OpenVibers/OpenVibe.Network/commit/0b3b2e3622ccdc12d04c71c3e537d365183d67dc))\n- The OpenVibe Frame: server/chrome is server/frame; /api/frame and /api/frame/hit (the /api/chrome names stay as aliases for openvibe-shared older than 1.11.0); chrome_cache/chrome_hits are renamed frame_cache/frame_hits once on boot, rows… ([`7571ba7`](https://github.com/OpenVibers/OpenVibe.Network/commit/7571ba73dce0fc199c2822cd2ee6493715efc3ed))\n\n## OpenVibe.Blog\n\n[openvibe.blog](https://openvibe.blog) · [repository](https://github.com/OpenVibers/OpenVibe.Blog)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`2c716a2`](https://github.com/OpenVibers/OpenVibe.Blog/commit/2c716a25c80258ebe2fbf4daae6ea49b73bd88f3))\n- openvibe-publishing v0.2.2 (shares the openvibe-shared v1.5.1 copy instead of installing v1.0.0 alongside) ([`a994d8a`](https://github.com/OpenVibers/OpenVibe.Blog/commit/a994d8a1a467b93ddf1fc11255f42ab0c31cc24e))\n- An edit that does not send citations keeps them: the /write editor does not resend a post's citations, so every edit made there dropped them from the new revision. Sending a list (even an empty one) still replaces them. lifecycle test ([`0784b42`](https://github.com/OpenVibers/OpenVibe.Blog/commit/0784b429a1bdcc3c770abed5800ca5171ecb0cf2))\n- VIP client from openvibe-sdk/vip (v0.7.0): the copy of openvibe-vip/client is replaced by the SDK's published seam, same API and fail-closed behaviour; server/vip/vip-client.js re-exports it so callers are unchanged ([`eae013f`](https://github.com/OpenVibers/OpenVibe.Blog/commit/eae013fe122a3dc1041342c4fe2de9a2832d4595))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared .github/workflows/test.yml@f5e7e73 (install, node --check over server/ and scripts/, npm test, openvibe-contracts-check) instead of a copy of those steps ([`36b6f59`](https://github.com/OpenVibers/OpenVibe.Blog/commit/36b6f598909bd1e425e20c0bd484886868acd988))\n- Draft with AI (W13, proof flow 5): a member who may write on a blog asks OpenVibe.AI's blog.draft_post (openvibe-publishing v0.3.0 ai client, Blog's service token) for a draft from a topic, brief, tone and audience; the answer becomes an… ([`4d522ca`](https://github.com/OpenVibers/OpenVibe.Blog/commit/4d522cac3c4b54bde24d4702ef27148d00222c0d))\n- The network changelog and its patch notes: every OpenVibe site's shipped commits in one feed, published on the blog in batches. The worker reads each service's repository and current release from OpenVibe.Network's registry, takes the… ([`32cb1aa`](https://github.com/OpenVibers/OpenVibe.Blog/commit/32cb1aa0eb6f9fef7a4728829d7b466c64e5aa34))\n- changelog: Network's /api/v1/registry/releases lists services under 'services' (the test stub now answers in that shape) ([`58d2e45`](https://github.com/OpenVibers/OpenVibe.Blog/commit/58d2e456ae3e93d539e4711ec722e3f462a2ed32))\n- changelog: every site's updates log — commit authors, a page cursor (before), a one-time import of each site's last CHANGELOG_HISTORY commits (never pending, never in a post), the recent patch notes posts and a per-site summary in the… ([`dc3f3a1`](https://github.com/OpenVibers/OpenVibe.Blog/commit/dc3f3a11af335ee1e102a76cde353bd68651e8b7))\n- The shared update system and one account UI: the home shows what shipped, /updates is the shared log, the footer (now initialised in the browser too) links it; the shared navbar handles sign in/out with logoutUrl ending this site's… ([`528f917`](https://github.com/OpenVibers/OpenVibe.Blog/commit/528f9170bded7ba55dfc1c1db73cf9eaae87e28e))\n- The OpenVibe Frame: openvibe-shared/frame (formerly chrome-ssr) and 1.11.0; openvibe-publishing 0.3.2 (one copy of openvibe-shared) ([`e4d201c`](https://github.com/OpenVibers/OpenVibe.Blog/commit/e4d201c915d3060a26c5a26a84bba0854a4b7d98))\n\n## OpenVibe.Host\n\n[openvibe.host](https://openvibe.host) · [repository](https://github.com/OpenVibers/OpenVibe.Host)\n\n- SECURITY.md: how to report a vulnerability (contact@openvibe.network, 7-day reply, scope, supported versions) ([`ff1c02e`](https://github.com/OpenVibers/OpenVibe.Host/commit/ff1c02edd07afefd5c57ef521c4f02acc2613f17))\n- Docs: ovhost deploys 20 services and runs the backups and drills (README said no deploy used it); cutover runbook gains the DNS steps (lower TTL a day ahead, record the old records, 30-minute watch, decommission after twice the old TTL)… ([`f8ac37d`](https://github.com/OpenVibers/OpenVibe.Host/commit/f8ac37d08425f0ff3779084db7146eb262576769))\n- Restore drills for AI, Games and Tools pass on the host (2026-09-24): AI's drill spec (AI_ENABLED=0, every provider key and seam blanked, no service secret, events or whisper; configuration counts) is new; Games' and Tools' reviewed specs… ([`438b642`](https://github.com/OpenVibers/OpenVibe.Host/commit/438b6423a1e2c44d321406fd4e16e47c97513da3))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared test.yml@e8b0caf (install, node --check, npm test, openvibe-contracts-check; ffmpeg where the tests need it) instead of a copy of those steps ([`f7fdbcc`](https://github.com/OpenVibers/OpenVibe.Host/commit/f7fdbcc6cdb7c9b0e40957ec868274a0203d4326))\n- C-76 retired: Live runs the release layout since 2026-09-24 05:51 UTC; inventory example reads Live's release (repo current, owner root, runAs ubuntu); Live drill row in the release layout ([`8b720df`](https://github.com/OpenVibers/OpenVibe.Host/commit/8b720df5079019789613cce08327a8ba6fd3fddf))\n- Metrics collection (Track O): scripts/prometheus-config.js renders a Prometheus scrape config from the host inventory (one loopback job per service port, declared extra processes such as the Tools satellites, node-exporter; metrics:false… ([`6ff101e`](https://github.com/OpenVibers/OpenVibe.Host/commit/6ff101ee18ba51469018e6c86e908bda10a765a9))\n- Tests follow Live's release layout (C-76): the example inventory's live entry reads /opt/openvibe.live/current as root with runAs ubuntu, and the live drill test's simulated host has the release unit and files under current/ ([`22e9f1c`](https://github.com/OpenVibers/OpenVibe.Host/commit/22e9f1cdeb60d91943a9fae2bbcb267b2162fb6d))\n- Alert rules (Track O): deploy/prometheus/openvibe-rules.yml (target down 5 min, 5xx above 5% for 10 min, root disk under 10%, memory under 8%), loaded through rule_files in the rendered config; firing alerts at 127.0.0.1:9090/api/v1/alerts ([`25e6fc0`](https://github.com/OpenVibers/OpenVibe.Host/commit/25e6fc0277eb7c297900a74cc59bd018b389554b))\n- The shared update system and one account UI, on the OpenVibe Frame (openvibe-shared 1.11.0, openvibe/frame): the home shows what shipped, /updates is the shared log and the footer links it; the shared navbar handles sign in and out… ([`d5fb2dc`](https://github.com/OpenVibers/OpenVibe.Host/commit/d5fb2dc7bce8b69c1334d940e9ed02b176bbb253))\n\n## OpenVibe.Live\n\n[openvibe.live](https://openvibe.live) · [repository](https://github.com/OpenVibers/OpenVibe.Live)\n\n- Crawlable pages for the Content and Moments feeds (D44): /content?page=N and /moments?page=N render page N of the cursor feed in the initial HTML (following N-1 cursors, each page cached, 20 deep), self-canonical, with newer/older… ([`d4ccdfb`](https://github.com/OpenVibers/OpenVibe.Live/commit/d4ccdfb0ee695be1ed8ec9702eea036cf8885a28))\n- VIP first for subscriber perks (W10, proof flow 3): with Billing as the money authority, whether a viewer is subscribed to a channel (channel state, chat and AI perks) is OpenVibe.VIP's entitlement answer through openvibe-sdk/vip (v0.7.0)… ([`e08bbec`](https://github.com/OpenVibers/OpenVibe.Live/commit/e08bbecdb2ebdef57d0da64213deb765e18a94ce))\n- CI calls the shared test workflow (Track Q): OpenVibe.Shared test.yml@e8b0caf (install, node --check over server/, scripts/ and public/js/, npm test with the size budgets, openvibe-contracts-check) instead of a copy of those steps ([`862bc47`](https://github.com/OpenVibers/OpenVibe.Live/commit/862bc470701aad2942f48ab6409feb8c6d2d424e))\n- Unit description matches production (no 'Free' copy) in both the in-place and release units ([`9f7f36c`](https://github.com/OpenVibers/OpenVibe.Live/commit/9f7f36c7d492266f27484c659ed84a7481803345))\n- release.json names the release in the release layout: the service user cannot run git in a root-owned release worktree, so the manifest said 0000000 (open tabs could not tell releases apart); RELEASE_COMMIT, else the