openvibers/openvibe.contracts Commits

Contracts 0.179.0: Watch can use project secrets (source credential and webhook secret_ref, project_env) (#139)

OP OpenVibers committed 29 days ago · 62bf440885 · 44 files, +897 −439

**Watch can use project secrets (Contracts 0.179.0, ADR-056).**

- **Source credentials:** `auth.secret_ref` may stand in place of `auth.env`. It names a project secret in the watch's project and `project_env`, granted to `watch` for `reveal` to the source URL's origin. Network answers the value at fetch time and Watch never stores it.
- **Webhook actions:** `secret_ref` may stand in place of `secret_env`. It names a project secret granted to `watch` for `sign`, so Network signs each delivery in the same headers and Watch never holds the value. The action now requires one of the two (`anyOf`); `secret_env` is unchanged.
- **`project_env`:** on `watch.watch-request@1` (sandbox or production, production by default when the watch names a project) and on `watch.watch@1` (nullable). A watch's project comes from a person's delegation, which carries no token environment, so the watch says it.
- **Fixtures:** a valid project watch with a webhook `secret_ref`, and an invalid webhook action with neither secret.
- **Checks:** 20,110 pass; `compat` against v0.178.0 and v0.177.0 finds no breaking change; generated artifacts are regenerated.

Next: Network grants watch `network.secret.use`, and Watch implements it.

Changes

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex c6e30b2a..2dbb3e46 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -4,6 +4,17 @@ All notable changes to `openvibe-contracts`. Releases are git tags (`vX.Y.Z`) th
  from `https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/<tag>`. Before v0.30.0,
  the notes were in the tag and commit messages (`git tag -n1`).
  
++## 0.179.0 — 2026-10-15
++
++- **Watch uses project secrets** (ADR-056).
++  - A source credential (`auth`) may name `secret_ref` instead of `env`: a project secret granted to `watch` for
++    `reveal` to the source URL's origin, answered by OpenVibe.Network at fetch time.
++  - A webhook action may name `secret_ref` instead of `secret_env`: a project secret granted to `watch` for `sign`, so
++    Network signs each delivery and Watch never holds the value. Exactly one of the two is required.
++  - `watch.watch-request@1` takes `project_env` (sandbox or production; production by default when the watch names a
++    project), and `watch.watch@1` shows it.
++- Fixtures: a watch with a project webhook secret, and an invalid webhook action with neither secret.
++
  ## 0.178.0 — 2026-10-15
  
  - **Actor webhooks name a project secret** (ADR-044 §7, ADR-056). `actor.task-create-request@1` webhooks take
ddiff --git a/contracts/watch/watch-request.v1.json b/contracts/watch/watch-request.v1.json
iindex 5051ed51..972d052a 100644
---- a/contracts/watch/watch-request.v1.json
++++ b/contracts/watch/watch-request.v1.json
@@@ -9,6 +9,7 @@
      "name": { "type": "string", "minLength": 1, "maxLength": 120 },
      "labels": { "type": "object", "additionalProperties": { "type": "string", "maxLength": 60 } },
      "project_id": { "type": ["string", "null"], "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$", "description": "The project the watch's project work belongs to (its run-job actions are billed to it). The acting person must be an admin or owner of the unarchived project: Watch checks with Network when it is saved (network.project.member.read; 403 project.not_delegated otherwise) and OpenVibe.Run checks again at every job (ADR-003 amendment 2026-10-12). null clears it." },
++    "project_env": { "enum": ["sandbox", "production"], "description": "The project environment the watch's project secrets (ADR-056: a source credential's or a webhook action's secret_ref) are looked up in. Defaults to production when the watch names a project; meaningless without one." },
      "source": { "$ref": "watch.v1.json#/$defs/source" },
      "cadence": { "$ref": "watch.v1.json#/$defs/cadence" },
      "extraction": { "$ref": "watch.v1.json#/$defs/extraction" },
ddiff --git a/contracts/watch/watch.v1.json b/contracts/watch/watch.v1.json
iindex e375186b..d5b7b263 100644
---- a/contracts/watch/watch.v1.json
++++ b/contracts/watch/watch.v1.json
@@@ -28,6 +28,14 @@
        ],
        "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$"
      },
++    "project_env": {
++      "enum": [
++        "sandbox",
++        "production",
++        null
++      ],
++      "description": "The project environment its project secrets (ADR-056, secret_ref) are looked up in; null when the watch names no project."
++    },
      "owner": {
        "type": "string",
        "description": "The acting person or agent the watch belongs to: usr_…, agt_… or svc:…."
@@@ -121,6 +129,14 @@
            "pattern": "^WATCH_CRED_[A-Z0-9_]{2,60}$",
            "description": "The name of the environment variable holding the credential; Watch reads it by name at fetch time and never stores the value."
          },
++        "secret_ref": {
++          "type": [
++            "string",
++            "null"
++          ],
++          "pattern": "^[a-z][a-z0-9_-]{0,63}$",
++          "description": "Instead of env: the name of a project secret (ADR-056) in the watch's project and project_env, granted to watch for reveal to the source URL's origin. OpenVibe.Network answers the value at fetch time; Watch never stores it."
++        },
          "header": {
            "type": [
              "string",
@@@ -502,8 +518,19 @@
            "type": "object",
            "required": [
              "kind",
--            "url",
--            "secret_env"
++            "url"
++          ],
++          "anyOf": [
++            {
++              "required": [
++                "secret_env"
++              ]
++            },
++            {
++              "required": [
++                "secret_ref"
++              ]
++            }
            ],
            "additionalProperties": false,
            "properties": {
@@@ -518,6 +545,11 @@
              "secret_env": {
                "type": "string",
                "pattern": "^WATCH_HOOK_[A-Z0-9_]{2,60}$"
++            },
++            "secret_ref": {
++              "type": "string",
++              "pattern": "^[a-z][a-z0-9_-]{0,63}$",
++              "description": "Instead of secret_env: the name of a project secret (ADR-056) in the watch's project and project_env, granted to watch for sign. OpenVibe.Network signs each delivery in the same headers; Watch never holds the value."
              }
            }
          },
ddiff --git a/fixtures/watch.watch-request/invalid/webhook-without-secret.json b/fixtures/watch.watch-request/invalid/webhook-without-secret.json
nnew file mode 100644
iindex 00000000..39c8fde3
---- /dev/null
++++ b/fixtures/watch.watch-request/invalid/webhook-without-secret.json
@@@ -0,0 +1,45 @@
++{
++  "name": "Tell my server when the release changes",
++  "source": {
++    "kind": "event",
++    "pattern": "host.release.published",
++    "filter": null
++  },
++  "cadence": null,
++  "extraction": {
++    "kind": "json",
++    "selector": null,
++    "fields": null,
++    "value_path": "$.release",
++    "ai": null
++  },
++  "comparison": {
++    "mode": "changed",
++    "tolerance": null,
++    "percent": null
++  },
++  "condition": {
++    "op": "changed",
++    "value": null,
++    "for_sec": null
++  },
++  "action": [
++    {
++      "kind": "webhook",
++      "url": "https://hooks.example.com/watch"
++    }
++  ],
++  "budget": {
++    "checks_per_day": 100,
++    "usd_per_month": 0,
++    "max_runtime_ms": 5000,
++    "max_bytes": 1048576
++  },
++  "retention": {
++    "observations_days": 30,
++    "keep_snapshots": false
++  },
++  "status": "active",
++  "project_id": "prj_01JAB2C3D4E5F6G7H8J9K0MNPR",
++  "project_env": "production"
++}
ddiff --git a/fixtures/watch.watch-request/valid/project-webhook-secret.json b/fixtures/watch.watch-request/valid/project-webhook-secret.json
nnew file mode 100644
iindex 00000000..932068c9
---- /dev/null
++++ b/fixtures/watch.watch-request/valid/project-webhook-secret.json
@@@ -0,0 +1,46 @@
++{
++  "name": "Tell my server when the release changes",
++  "source": {
++    "kind": "event",
++    "pattern": "host.release.published",
++    "filter": null
++  },
++  "cadence": null,
++  "extraction": {
++    "kind": "json",
++    "selector": null,
++    "fields": null,
++    "value_path": "$.release",
++    "ai": null
++  },
++  "comparison": {
++    "mode": "changed",
++    "tolerance": null,
++    "percent": null
++  },
++  "condition": {
++    "op": "changed",
++    "value": null,
++    "for_sec": null
++  },
++  "action": [
++    {
++      "kind": "webhook",
++      "url": "https://hooks.example.com/watch",
++      "secret_ref": "webhook-signing"
++    }
++  ],
++  "budget": {
++    "checks_per_day": 100,
++    "usd_per_month": 0,
++    "max_runtime_ms": 5000,
++    "max_bytes": 1048576
++  },
++  "retention": {
++    "observations_days": 30,
++    "keep_snapshots": false
++  },
++  "status": "active",
++  "project_id": "prj_01JAB2C3D4E5F6G7H8J9K0MNPR",
++  "project_env": "production"
++}
ddiff --git a/generated/json-schema/bundle.json b/generated/json-schema/bundle.json
iindex bbc9fb4b..527f50c2 100644
---- a/generated/json-schema/bundle.json
++++ b/generated/json-schema/bundle.json
@@@ -47169,6 +47169,14 @@
              ],
              "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$"
            },
++          "project_env": {
++            "enum": [
++              "sandbox",
++              "production",
++              null
++            ],
++            "description": "The project environment its project secrets (ADR-056, secret_ref) are looked up in; null when the watch names no project."
++          },
            "owner": {
              "type": "string",
              "description": "The acting person or agent the watch belongs to: usr_…, agt_… or svc:…."
@@@ -47262,6 +47270,14 @@
                  "pattern": "^WATCH_CRED_[A-Z0-9_]{2,60}$",
                  "description": "The name of the environment variable holding the credential; Watch reads it by name at fetch time and never stores the value."
                },
++              "secret_ref": {
++                "type": [
++                  "string",
++                  "null"
++                ],
++                "pattern": "^[a-z][a-z0-9_-]{0,63}$",
++                "description": "Instead of env: the name of a project secret (ADR-056) in the watch's project and project_env, granted to watch for reveal to the source URL's origin. OpenVibe.Network answers the value at fetch time; Watch never stores it."
++              },
                "header": {
                  "type": [
                    "string",
@@@ -47643,8 +47659,19 @@
                  "type": "object",
                  "required": [
                    "kind",
--                  "url",
--                  "secret_env"
++                  "url"
++                ],
++                "anyOf": [
++                  {
++                    "required": [
++                      "secret_env"
++                    ]
++                  },
++                  {
++                    "required": [
++                      "secret_ref"
++                    ]
++                  }
                  ],
                  "additionalProperties": false,
                  "properties": {
@@@ -47659,6 +47686,11 @@
                    "secret_env": {
                      "type": "string",
                      "pattern": "^WATCH_HOOK_[A-Z0-9_]{2,60}$"
++                  },
++                  "secret_ref": {
++                    "type": "string",
++                    "pattern": "^[a-z][a-z0-9_-]{0,63}$",
++                    "description": "Instead of secret_env: the name of a project secret (ADR-056) in the watch's project and project_env, granted to watch for sign. OpenVibe.Network signs each delivery in the same headers; Watch never holds the value."
                    }
                  }
                },
@@@ -47878,6 +47910,13 @@
              "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$",
              "description": "The project the watch's project work belongs to (its run-job actions are billed to it). The acting person must be an admin or owner of the unarchived project: Watch checks with Network when it is saved (network.project.member.read; 403 project.not_delegated otherwise) and OpenVibe.Run checks again at every job (ADR-003 amendment 2026-10-12). null clears it."
            },
++          "project_env": {
++            "enum": [
++              "sandbox",
++              "production"
++            ],
++            "description": "The project environment the watch's project secrets (ADR-056: a source credential's or a webhook action's secret_ref) are looked up in. Defaults to production when the watch names a project; meaningless without one."
++          },
            "source": {
              "$ref": "watch.v1.json#/$defs/source"
            },
ddiff --git a/generated/openapi/actor.json b/generated/openapi/actor.json
iindex 1981eb80..e2a14c84 100644
---- a/generated/openapi/actor.json
++++ b/generated/openapi/actor.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Actor API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Actor as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/ai.json b/generated/openapi/ai.json
iindex 21c82439..34959e74 100644
---- a/generated/openapi/ai.json
++++ b/generated/openapi/ai.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.AI API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.AI as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/billing.json b/generated/openapi/billing.json
iindex aeefae64..03b366f3 100644
---- a/generated/openapi/billing.json
++++ b/generated/openapi/billing.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Billing API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Billing as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/blog.json b/generated/openapi/blog.json
iindex 73c2a3cf..5cece374 100644
---- a/generated/openapi/blog.json
++++ b/generated/openapi/blog.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Blog API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Blog as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/bot.json b/generated/openapi/bot.json
iindex a4733d89..7cc45f75 100644
---- a/generated/openapi/bot.json
++++ b/generated/openapi/bot.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Bot API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Bot as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/chat.json b/generated/openapi/chat.json
iindex 95d4cd43..8fbd4bef 100644
---- a/generated/openapi/chat.json
++++ b/generated/openapi/chat.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Chat API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Chat as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/codes.json b/generated/openapi/codes.json
iindex 0a9051eb..6f289982 100644
---- a/generated/openapi/codes.json
++++ b/generated/openapi/codes.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Codes API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Codes as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/community.json b/generated/openapi/community.json
iindex 7e892aae..3d1cad01 100644
---- a/generated/openapi/community.json
++++ b/generated/openapi/community.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Community API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Community as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/coupons.json b/generated/openapi/coupons.json
iindex aa9a3d47..fe3ef097 100644
---- a/generated/openapi/coupons.json
++++ b/generated/openapi/coupons.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Coupons API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Coupons as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/deals.json b/generated/openapi/deals.json
iindex dd918c45..3bac80a8 100644
---- a/generated/openapi/deals.json
++++ b/generated/openapi/deals.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Deals API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Deals as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/events.json b/generated/openapi/events.json
iindex f6e23d30..d5d068dc 100644
---- a/generated/openapi/events.json
++++ b/generated/openapi/events.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Events API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Events as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/food.json b/generated/openapi/food.json
iindex ef4f8ef9..275645a0 100644
---- a/generated/openapi/food.json
++++ b/generated/openapi/food.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Food API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Food as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/games.json b/generated/openapi/games.json
iindex 7eabd605..4fe86215 100644
---- a/generated/openapi/games.json
++++ b/generated/openapi/games.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Games API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Games as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/host.json b/generated/openapi/host.json
iindex 63a3ad89..0724d4de 100644
---- a/generated/openapi/host.json
++++ b/generated/openapi/host.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Host API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Host as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/inventory.json b/generated/openapi/inventory.json
iindex 492aeaba..2171687f 100644
---- a/generated/openapi/inventory.json
++++ b/generated/openapi/inventory.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Inventory API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Inventory as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/live.json b/generated/openapi/live.json
iindex ca1947ce..8556914c 100644
---- a/generated/openapi/live.json
++++ b/generated/openapi/live.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Live API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Live as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media-hub.json b/generated/openapi/media-hub.json
iindex da898b01..44041017 100644
---- a/generated/openapi/media-hub.json
++++ b/generated/openapi/media-hub.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.MediaHub API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.MediaHub as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/media.json b/generated/openapi/media.json
iindex 956d6443..04d1cfd7 100644
---- a/generated/openapi/media.json
++++ b/generated/openapi/media.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Media API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Media as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/network.json b/generated/openapi/network.json
iindex e7af95a9..a6321ff8 100644
---- a/generated/openapi/network.json
++++ b/generated/openapi/network.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Network API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Network as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/news.json b/generated/openapi/news.json
iindex f3eda66a..36f94b9f 100644
---- a/generated/openapi/news.json
++++ b/generated/openapi/news.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.News API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.News as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/openre.json b/generated/openapi/openre.json
iindex 2349045e..6de4401a 100644
---- a/generated/openapi/openre.json
++++ b/generated/openapi/openre.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenRestream API",
--  "version": "0.178.0",
--  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenRestream as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/play.json b/generated/openapi/play.json
iindex 14e1627b..1b8f4d36 100644
---- a/generated/openapi/play.json
++++ b/generated/openapi/play.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Play API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Play as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/reviews.json b/generated/openapi/reviews.json
iindex da8e79e1..86d8ff87 100644
---- a/generated/openapi/reviews.json
++++ b/generated/openapi/reviews.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Reviews API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Reviews as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/run.json b/generated/openapi/run.json
iindex dbc4c675..9f78692b 100644
---- a/generated/openapi/run.json
++++ b/generated/openapi/run.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Run API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Run as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/search.json b/generated/openapi/search.json
iindex 1458224f..d2a7d0e7 100644
---- a/generated/openapi/search.json
++++ b/generated/openapi/search.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Search API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Search as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/services.json b/generated/openapi/services.json
iindex 2a62af4a..8cbfe9a0 100644
---- a/generated/openapi/services.json
++++ b/generated/openapi/services.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Services API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Services as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/sources.json b/generated/openapi/sources.json
iindex 6906bdad..2feda794 100644
---- a/generated/openapi/sources.json
++++ b/generated/openapi/sources.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Sources API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Sources as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/space.json b/generated/openapi/space.json
iindex b2a22e80..619e5543 100644
---- a/generated/openapi/space.json
++++ b/generated/openapi/space.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Space API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Space as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tips.json b/generated/openapi/tips.json
iindex c7d570a8..ba4b7701 100644
---- a/generated/openapi/tips.json
++++ b/generated/openapi/tips.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tips API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Tips as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/tools.json b/generated/openapi/tools.json
iindex f836f4e8..3e708e52 100644
---- a/generated/openapi/tools.json
++++ b/generated/openapi/tools.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Tools API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Tools as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/trade.json b/generated/openapi/trade.json
iindex 74d7ba4a..a533d322 100644
---- a/generated/openapi/trade.json
++++ b/generated/openapi/trade.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Trade API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Trade as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/vip.json b/generated/openapi/vip.json
iindex 3eee683e..d88f5eff 100644
---- a/generated/openapi/vip.json
++++ b/generated/openapi/vip.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.VIP API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.VIP as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/watch.json b/generated/openapi/watch.json
iindex 1b44f89a..b6b72d7f 100644
---- a/generated/openapi/watch.json
++++ b/generated/openapi/watch.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Watch API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Watch as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
@@@ -344,6 +344,19 @@
        },
        "description": "The project the watch's project work belongs to (its run-job actions are billed to it). The acting person must be an admin or owner of the unarchived project: Watch checks with Network when it is saved (network.project.member.read; 403 project.not_delegated otherwise) and OpenVibe.Run checks again at every job (ADR-003 amendment 2026-10-12). null clears it."
       },
++     {
++      "name": "project_env",
++      "in": "query",
++      "required": false,
++      "schema": {
++       "enum": [
++        "sandbox",
++        "production"
++       ],
++       "description": "The project environment the watch's project secrets (ADR-056: a source credential's or a webhook action's secret_ref) are looked up in. Defaults to production when the watch names a project; meaningless without one."
++      },
++      "description": "The project environment the watch's project secrets (ADR-056: a source credential's or a webhook action's secret_ref) are looked up in. Defaults to production when the watch names a project; meaningless without one."
++     },
       {
        "name": "source",
        "in": "query",
@@@ -1886,6 +1899,13 @@
        "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$",
        "description": "The project the watch's project work belongs to (its run-job actions are billed to it). The acting person must be an admin or owner of the unarchived project: Watch checks with Network when it is saved (network.project.member.read; 403 project.not_delegated otherwise) and OpenVibe.Run checks again at every job (ADR-003 amendment 2026-10-12). null clears it."
       },
++     "project_env": {
++      "enum": [
++       "sandbox",
++       "production"
++      ],
++      "description": "The project environment the watch's project secrets (ADR-056: a source credential's or a webhook action's secret_ref) are looked up in. Defaults to production when the watch names a project; meaningless without one."
++     },
       "source": {
        "$ref": "#/components/schemas/watch.watch.v1/$defs/source"
       },
@@@ -2025,6 +2045,14 @@
        ],
        "pattern": "^prj_[0-9A-HJKMNP-TV-Z]{26}$"
       },
++     "project_env": {
++      "enum": [
++       "sandbox",
++       "production",
++       null
++      ],
++      "description": "The project environment its project secrets (ADR-056, secret_ref) are looked up in; null when the watch names no project."
++     },
       "owner": {
        "type": "string",
        "description": "The acting person or agent the watch belongs to: usr_…, agt_… or svc:…."
@@@ -2118,6 +2146,14 @@
          "pattern": "^WATCH_CRED_[A-Z0-9_]{2,60}$",
          "description": "The name of the environment variable holding the credential; Watch reads it by name at fetch time and never stores the value."
         },
++       "secret_ref": {
++        "type": [
++         "string",
++         "null"
++        ],
++        "pattern": "^[a-z][a-z0-9_-]{0,63}$",
++        "description": "Instead of env: the name of a project secret (ADR-056) in the watch's project and project_env, granted to watch for reveal to the source URL's origin. OpenVibe.Network answers the value at fetch time; Watch never stores it."
++       },
         "header": {
          "type": [
           "string",
@@@ -2499,8 +2535,19 @@
          "type": "object",
          "required": [
           "kind",
--         "url",
--         "secret_env"
++         "url"
++        ],
++        "anyOf": [
++         {
++          "required": [
++           "secret_env"
++          ]
++         },
++         {
++          "required": [
++           "secret_ref"
++          ]
++         }
          ],
          "additionalProperties": false,
          "properties": {
@@@ -2515,6 +2562,11 @@
           "secret_env": {
            "type": "string",
            "pattern": "^WATCH_HOOK_[A-Z0-9_]{2,60}$"
++         },
++         "secret_ref": {
++          "type": "string",
++          "pattern": "^[a-z][a-z0-9_-]{0,63}$",
++          "description": "Instead of secret_env: the name of a project secret (ADR-056) in the watch's project and project_env, granted to watch for sign. OpenVibe.Network signs each delivery in the same headers; Watch never holds the value."
           }
          }
         },
ddiff --git a/generated/openapi/wiki.json b/generated/openapi/wiki.json
iindex f2ce31f0..f406606f 100644
---- a/generated/openapi/wiki.json
++++ b/generated/openapi/wiki.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Wiki API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Wiki as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/work.json b/generated/openapi/work.json
iindex 094e1a7d..015503d3 100644
---- a/generated/openapi/work.json
++++ b/generated/openapi/work.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Work API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Work as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/openapi/zone.json b/generated/openapi/zone.json
iindex a733bb97..1377f6ae 100644
---- a/generated/openapi/zone.json
++++ b/generated/openapi/zone.json
@@@ -3,8 +3,8 @@
   "jsonSchemaDialect": "https://json-schema.org/draft/2020-12/schema",
   "info": {
    "title": "OpenVibe.Zone API",
--  "version": "0.178.0",
--  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.178.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
++  "version": "0.179.0",
++  "description": "Routes of OpenVibe.Zone as the OpenVibe contracts describe them (openvibe-contracts 0.179.0): each operation lists the capabilities it performs; a token for the service's audience must carry one of them unless the route is open. Generated by openvibe-contracts lib/openapi.js; do not edit.",
    "license": {
     "name": "MIT",
     "identifier": "MIT"
ddiff --git a/generated/typescript/index.d.ts b/generated/typescript/index.d.ts
iindex 5b017526..78f9b684 100644
---- a/generated/typescript/index.d.ts
++++ b/generated/typescript/index.d.ts
@@@ -169041,6 +169041,10 @@ export interface TradeWatchlist {
  export interface Watch {
    id: string;
    project_id?: string | null;
++  /**
++   * The project environment its project secrets (ADR-056, secret_ref) are looked up in; null when the watch names no project.
++   */
++  project_env?: "sandbox" | "production" | null;
    /**
     * The acting person or agent the watch belongs to: usr_…, agt_… or svc:….
     */
@@@ -169077,6 +169081,10 @@ export interface Watch {
             * The name of the environment variable holding the credential; Watch reads it by name at fetch time and never stores the value.
             */
            env?: string | null;
++          /**
++           * Instead of env: the name of a project secret (ADR-056) in the watch's project and project_env, granted to watch for reveal to the source URL's origin. OpenVibe.Network answers the value at fetch time; Watch never stores it.
++           */
++          secret_ref?: string | null;
            header?: string | null;
            param?: string | null;
          };
@@@ -169165,11 +169173,14 @@ export interface Watch {
                [k: string]: unknown | undefined;
              } | null;
            }
--        | {
--            kind: "webhook";
--            url: string;
--            secret_env: string;
--          }
++        | (
++            | {
++                [k: string]: unknown | undefined;
++              }
++            | {
++                [k: string]: unknown | undefined;
++              }
++          )
          | {
              kind: "actor-task";
              brief: string;
@@@ -169249,11 +169260,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -169332,11 +169346,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -169417,11 +169434,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -169500,11 +169520,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -169583,11 +169606,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -169668,11 +169694,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -169751,11 +169780,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -169834,11 +169866,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -169917,11 +169952,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170002,11 +170040,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170085,11 +170126,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170168,11 +170212,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170251,11 +170298,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170334,11 +170384,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170419,11 +170472,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170502,11 +170558,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170585,11 +170644,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170668,11 +170730,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170751,11 +170816,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170834,11 +170902,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -170919,11 +170990,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171002,11 +171076,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171085,11 +171162,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171168,11 +171248,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171251,11 +171334,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171334,11 +171420,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171417,11 +171506,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171502,11 +171594,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171585,11 +171680,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171668,11 +171766,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171751,11 +171852,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171834,11 +171938,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -171917,11 +172024,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172000,11 +172110,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172083,11 +172196,14 @@ export interface Watch {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172184,6 +172300,10 @@ export interface WatchRequest {
     * The project the watch's project work belongs to (its run-job actions are billed to it). The acting person must be an admin or owner of the unarchived project: Watch checks with Network when it is saved (network.project.member.read; 403 project.not_delegated otherwise) and OpenVibe.Run checks again at every job (ADR-003 amendment 2026-10-12). null clears it.
     */
    project_id?: string | null;
++  /**
++   * The project environment the watch's project secrets (ADR-056: a source credential's or a webhook action's secret_ref) are looked up in. Defaults to production when the watch names a project; meaningless without one.
++   */
++  project_env?: "sandbox" | "production";
    source?:
      | {
          kind: "webhook";
@@@ -172211,6 +172331,10 @@ export interface WatchRequest {
             * The name of the environment variable holding the credential; Watch reads it by name at fetch time and never stores the value.
             */
            env?: string | null;
++          /**
++           * Instead of env: the name of a project secret (ADR-056) in the watch's project and project_env, granted to watch for reveal to the source URL's origin. OpenVibe.Network answers the value at fetch time; Watch never stores it.
++           */
++          secret_ref?: string | null;
            header?: string | null;
            param?: string | null;
          };
@@@ -172299,11 +172423,14 @@ export interface WatchRequest {
                [k: string]: unknown | undefined;
              } | null;
            }
--        | {
--            kind: "webhook";
--            url: string;
--            secret_env: string;
--          }
++        | (
++            | {
++                [k: string]: unknown | undefined;
++              }
++            | {
++                [k: string]: unknown | undefined;
++              }
++          )
          | {
              kind: "actor-task";
              brief: string;
@@@ -172383,11 +172510,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172466,11 +172596,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172551,11 +172684,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172634,11 +172770,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172717,11 +172856,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172802,11 +172944,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172885,11 +173030,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -172968,11 +173116,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173051,11 +173202,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173136,11 +173290,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173219,11 +173376,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173302,11 +173462,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173385,11 +173548,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173468,11 +173634,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173553,11 +173722,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173636,11 +173808,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173719,11 +173894,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173802,11 +173980,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173885,11 +174066,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -173968,11 +174152,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174053,11 +174240,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174136,11 +174326,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174219,11 +174412,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174302,11 +174498,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174385,11 +174584,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174468,11 +174670,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174551,11 +174756,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174636,11 +174844,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174719,11 +174930,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174802,11 +175016,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174885,11 +175102,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -174968,11 +175188,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -175051,11 +175274,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -175134,11 +175360,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
@@@ -175217,11 +175446,14 @@ export interface WatchRequest {
                  [k: string]: unknown | undefined;
                } | null;
              }
--          | {
--              kind: "webhook";
--              url: string;
--              secret_env: string;
--            }
++          | (
++              | {
++                  [k: string]: unknown | undefined;
++                }
++              | {
++                  [k: string]: unknown | undefined;
++                }
++            )
            | {
                kind: "actor-task";
                brief: string;
ddiff --git a/package.json b/package.json
iindex fbed115c..27f8bd0f 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-contracts",
--  "version": "0.178.0",
++  "version": "0.179.0",
    "description": "Machine-readable contracts for the OpenVibe network: schemas, manifests, ids, error envelope, capability checks.",
    "main": "index.js",
    "types": "generated/typescript/index.d.ts",