v0.37.0: network.integration.github.read — a first-party service (OpenVibe.Blog's changelog) reads the network's GitHub API token, which the owner sets in Network's admin panel or GITHUB_TOKEN; never for apps or mods

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex 4e8098cb..a48152e3 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,10 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th
  from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
  the notes were in the tag and commit messages (`git tag -n1`).
  
++## 0.37.0 — 2026-09-24
++
++`network.integration.github.read` (first-party only) lets a service read the network's GitHub API token. The owner sets the token in Network's admin panel, or in `GITHUB_TOKEN`. OpenVibe.Blog's network changelog uses it, so its GitHub calls do not share the host's anonymous rate limit. It is never granted to apps or mods. Additive.
++
  ## 0.36.0 — 2026-09-24
  
  The moderation audit log (ADR-022):
ddiff --git a/manifests/capabilities/network.integration.github.read.json b/manifests/capabilities/network.integration.github.read.json
nnew file mode 100644
iindex 00000000..d3bbdc74
---- /dev/null
++++ b/manifests/capabilities/network.integration.github.read.json
@@@ -0,0 +1,17 @@
++{
++  "id": "network.integration.github.read",
++  "version": "1.0",
++  "owner": "network",
++  "status": "active",
++  "visibility": "first-party",
++  "description": "Read the network's GitHub API token (read-only, public repositories), which the owner sets in Network's admin panel or in GITHUB_TOKEN. Used by OpenVibe.Blog's network changelog so its GitHub calls do not share the host's anonymous rate limit. Never granted to apps or mods.",
++  "permissions": [
++    "integrations:github:read"
++  ],
++  "resourceConstraints": [],
++  "quotaClass": "integration-secret",
++  "events": [],
++  "implementedBy": [
++    "GET /internal/integrations/github-token"
++  ]
++}
ddiff --git a/manifests/services/network.json b/manifests/services/network.json
iindex dd6f6882..04da6f8b 100644
---- a/manifests/services/network.json
++++ b/manifests/services/network.json
@@@ -19,15 +19,16 @@
    "health": "/api/health",
    "capabilities": [
      "identity.subject.resolve",
++    "mods.grant.manage",
      "network.coins.credit",
      "network.coins.debit",
      "network.coins.transfer",
--    "network.notifications.push",
++    "network.integration.github.read",
      "network.modules.read",
      "network.modules.write",
--    "mods.grant.manage",
--    "network.project.read",
--    "network.project.manage"
++    "network.notifications.push",
++    "network.project.manage",
++    "network.project.read"
    ],
    "eventsProduced": [
      "network.app.created",
ddiff --git a/package-lock.json b/package-lock.json
iindex f0e5ba45..be673fee 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.36.0",
++  "version": "0.37.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-contracts",
--      "version": "0.36.0",
++      "version": "0.37.0",
        "license": "AGPL-3.0-only",
        "dependencies": {
          "ajv": "^8.17.1",
ddiff --git a/package.json b/package.json
iindex 390cecd1..cebf918b 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.36.0",
++  "version": "0.37.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",